🔥 Trending CVEs - Last 90 Days

This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to bypass authentication and gain Administrator privile...

OpenEMR versions before 7.0.4 have a broken access control vulnerability in the Profile Edit endpoint. Authenticated normal users can modify request p...

This is a cross-site scripting (XSS) vulnerability in Ghost CMS that allows attackers to craft malicious links. When authenticated staff users or memb...

A vulnerability in PyTorch's `weights_only` unpickler allows attackers to craft malicious checkpoint files (.pth) that, when loaded, can corrupt memor...

A use-after-free vulnerability in Firefox's Layout: Scrolling and Overflow component allows attackers to execute arbitrary code by tricking users into...

A low-privileged remote attacker can execute arbitrary code by sending specially crafted calls to the Device Manager web service or local API, exploit...

This Cross-Site Request Forgery vulnerability in the EZCast Pro II admin interface allows attackers to trick authenticated administrators into executi...

This command injection vulnerability in TP-Link Archer MR600 v5 firmware allows authenticated attackers to execute system commands through the admin i...

This vulnerability allows unauthorized password changes on Tenda W30E V2 routers without verifying the current password. Attackers who gain access to ...

This vulnerability allows authenticated low-privileged users to change the administrator password on Tenda W30E V2 routers by exploiting an authorizat...

This CVE describes a privilege escalation vulnerability where the web server binary runs with root privileges, violating the principle of least privil...

CVE-2026-1428 is an OS command injection vulnerability in WellChoose's Single Sign-On Portal System that allows authenticated remote attackers to exec...

This vulnerability allows authenticated remote attackers to execute arbitrary operating system commands on servers running WellChoose's Single Sign-On...

This vulnerability allows remote attackers to execute arbitrary code on Tenda AC23 routers via a buffer overflow in the WifiExtraSet function. Attacke...

A heap buffer overflow vulnerability in iccDEV's CIccTagXmlSegmentedCurve::ToXml() function allows attackers to execute arbitrary code or cause denial...

CVE-2026-24406 is a heap buffer overflow vulnerability in iccDEV's CIccTagNamedColor2::SetSize() function that allows attackers to execute arbitrary c...

A heap buffer overflow vulnerability in iccDEV's CIccMpeCalculator::Read() function allows attackers to execute arbitrary code or cause denial of serv...

CVE-2021-47904 is an authenticated file upload vulnerability in PhreeBooks 5.2.3 that allows attackers to upload malicious PHP files through the Image...

CVE-2021-47903 is an authenticated command injection vulnerability in LiteSpeed Web Server Enterprise that allows authenticated administrators to exec...

CVE-2021-47888 is an authenticated remote code execution vulnerability in Textpattern CMS that allows logged-in users to upload malicious PHP files an...

This SQL injection vulnerability in the Nelio Content WordPress plugin allows attackers to execute arbitrary SQL commands through specially crafted in...

This CVE describes a Missing Authorization vulnerability in the uPress Booter WordPress plugin's bots-crawlers-manager component that allows attackers...

The Melapress Role Editor WordPress plugin has a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or hi...

Dell ECS and ObjectScale systems contain default credentials that allow low-privileged attackers with remote access to elevate privileges. This affect...

This vulnerability allows attackers with access to Moodle's restore interface to execute arbitrary code on the server due to insufficient input valida...

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on ALGO 8180 IP Audio Alerter devices through the web in...

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on ALGO 8180 IP Audio Alerter devices through command in...

CVE-2026-0785 is a command injection vulnerability in ALGO 8180 IP Audio Alerter devices that allows authenticated remote attackers to execute arbitra...

CVE-2026-0786 is a command injection vulnerability in ALGO 8180 IP Audio Alerter devices that allows authenticated remote attackers to execute arbitra...

This vulnerability allows network-adjacent attackers to execute arbitrary code on Enel X JuiceBox 40 electric vehicle charging stations without authen...

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on ALGO 8180 IP Audio Alerter devices via command inject...

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on ALGO 8180 IP Audio Alerter devices through the web in...

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on ALGO 8180 IP Audio Alerter devices through the web in...

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on ALGO 8180 IP Audio Alerter devices through the web in...

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on ALGO 8180 IP Audio Alerter devices through the web in...

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on ALGO 8180 IP Audio Alerter devices via command inject...

This vulnerability allows network-adjacent attackers to execute arbitrary code on WatchYourLAN installations without authentication. Attackers can inj...

This vulnerability allows authenticated remote attackers to execute arbitrary system commands on Open WebUI installations. Attackers can inject malici...

This vulnerability allows authenticated remote attackers to execute arbitrary Python code on Open WebUI installations via command injection in the loa...

This vulnerability allows remote attackers to execute arbitrary commands on systems running vulnerable versions of MCP Manager for Claude Desktop. Att...

A path traversal vulnerability in WebPros WordPress Toolkit before version 6.9.1 allows attackers to escalate privileges by manipulating WordPress dir...

This SQL injection vulnerability in the Traveler WordPress theme allows attackers to execute arbitrary SQL commands through unsanitized user input. It...

This CVE describes a Missing Authorization vulnerability in the WordPress plugin 'The Grid' that allows attackers to bypass access controls. It affect...

This CVE describes a Missing Authorization vulnerability in the EventPrime WordPress plugin that allows attackers to bypass access controls. It affect...

This CVE describes a Missing Authorization vulnerability in the Roxnor GetGenie WordPress plugin that allows attackers to bypass access controls. Atta...

This CVE describes a Missing Authorization vulnerability in the Quiz And Survey Master WordPress plugin that allows attackers to bypass access control...

This CVE describes a Missing Authorization vulnerability in the Golo WordPress theme that allows attackers to bypass access controls. It affects all v...

This CVE describes a Missing Authorization vulnerability in the BD Courier Order Ratio Checker WordPress plugin that allows attackers to bypass access...

This CVE describes a Missing Authorization vulnerability in the Easy Form Builder WordPress plugin that allows attackers to bypass access controls. It...

This vulnerability allows attackers to escalate privileges in the WP Membership WordPress plugin, potentially granting unauthorized administrative acc...